Checkmarx • Application security
Checkmarx SCA finds open-source vulnerabilities and license risk across the dependency tree, then applies Exploitable Path Analysis (EPA) to demote CVEs that are not actually reachable from the customer's code so the AppSec backlog reflects exploitable risk instead of the full CVE list.
A Merito Checkmarx SCA engagement turns on EPA reachability by default, tunes per-application license policy, and wires PR-time gates so SCA stops being a noise generator and becomes a triage queue AppSec can actually work.
What it is
Checkmarx SCA is the Software Composition Analysis engine inside Checkmarx One. It scans open-source dependencies in package manifests (package.json, pom.xml, requirements.txt, go.mod, Cargo.toml, Gemfile, composer.json, build.gradle, *.csproj) and the resolved transitive graph, then matches against the CVE database, license catalog, and known-bad indicators. Same shape as Snyk SCA, Black Duck, or Sonatype Lifecycle, with the differentiator being how Checkmarx reduces the noise.
Exploitable Path Analysis (EPA) is the load-bearing capability. A traditional SCA tool reports every CVE in every dependency in the tree. Most of those CVEs sit in code paths that the application never calls. EPA performs reachability analysis on the customer's actual code (cross-checked with Checkmarx SAST) and downgrades CVEs in unreachable code to a lower severity. On portfolios with deep dependency trees, EPA reduces the AppSec backlog by a meaningful margin because findings reflect what an attacker can exploit instead of every theoretically vulnerable line.
License compliance is the other half of SCA. Programs that ship code with copyleft licenses (GPL, AGPL) into proprietary products create legal exposure. Checkmarx SCA evaluates every dependency against a configurable license policy and flags forbidden licenses before they reach production. Policy can differ by application or business unit, so a GPL library in an internal tool is judged differently from the same library in a customer-facing SaaS product.
Alert fatigue is where SCA programs stall. When vendor-default policies run with EPA switched off and every CVE goes to the developer queue, the engineering organization and the AppSec team burn out together. A Checkmarx SCA rollout therefore turns EPA on by default, tunes license policy, keeps an audit trail on suppressions, and shows findings during pull-request review instead of in a separate dashboard. Without that, SCA generates more noise than it removes.
Ideal use cases
What it is best at
Cross-checks SCA findings against actual code paths from Checkmarx SAST. CVEs in unreachable code drop in severity. On large dependency trees this is the difference between a paralyzing backlog and one AppSec can work.
npm, PyPI, Maven Central, Maven, NuGet, Go modules, Cargo, Gem, Composer, and more in one engine, so JavaScript, Python and Java services in the same portfolio share one dependency view.
Different license rules for internal tooling versus customer-facing SaaS. Programs avoid blanket copyleft bans that block legitimate internal use of GPL libraries.
SCA findings link back to the SAST flow path that calls the dependency and the DAST runtime confirmation. Triage and Remediation clusters SCA findings with related SAST findings on root cause.
Generates SBOMs in industry-standard formats for regulated programs (federal, healthcare, financial services) that require SBOM-as-evidence under EO 14028 or sector-specific mandates.
Core capabilities
Where SCA earns its keep against the noise of a flat CVE list.
Direct and transitive dependency scanning
Resolves the full dependency graph and surfaces vulnerabilities across direct and transitive dependencies.
Exploitable Path Analysis (EPA)
Reachability-aware scoring. A CVE in a dependency function the application never calls from production is demoted, leaving reachable vulnerabilities at the top of the queue.
Ecosystem coverage
npm, PyPI, Maven Central, Maven, NuGet, Go modules, Cargo, Gem, Composer, and more in one engine.
Container and IaC dependency awareness
Crosses with Container Security and IaC Security to surface dependencies inside images and infrastructure templates.
Avoiding legal exposure on copyleft and forbidden licenses without blanket bans.
Per-application license policy
Different license rules for internal tooling versus customer-facing SaaS. Avoids blanket copyleft bans that block legitimate internal use.
License obligation tracking
Surfaces attribution requirements, source-disclosure obligations, and license-compatibility issues across the dependency graph.
Forbidden-license gates
New copyleft dependencies are refused at the pull request, while licenses already in the codebase are reviewed and resolved separately.
Audit-ready evidence for regulated and federal programs.
CycloneDX and SPDX SBOM generation
SBOM output in industry-standard formats for compliance with EO 14028, NIST SSDF, and sector-specific mandates.
Cross-product correlation
A vulnerable dependency links to the SAST flow path that calls it, any DAST confirmation, and the container images that ship it.
Triage and Remediation clustering
Triage and Remediation folds a dependency finding and the SAST and runtime findings it causes into one item, so an upgrade closes them together.
Compliance reporting
SBOMs, license decisions and dependency scan history exported as evidence for PCI DSS, HIPAA, SOC 2, ISO 27001 and FedRAMP attestations.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
Checkmarx One Essentials
SCA plus baseline SAST and Container Security in a single bundle.
Best for: Programs starting consolidation onto Checkmarx One.
Checkmarx One Advanced
Adds the sourcing-time controls SCA pairs with, Malicious Package Protection and Repository Health, plus DAST, API Security and IaC Security.
Best for: Mature AppSec programs running multiple scan types.
Checkmarx One Enterprise
Puts Software Supply Chain Security and AI Supply Chain Security on top of SCA. Premium SLAs and the Developer Assist and Triage and Remediation agents are included.
Best for: Enterprise programs with AI-augmented triage and supply-chain governance in scope.
Merito services
Pick the engagement that matches where you are in the lifecycle.
Tenant setup, EPA configuration, license-policy tuning, CI/CD integration, and SBOM generation wiring.
Explore serviceAppSec program scoping for Checkmarx SCA adoption alongside Snyk SCA, Black Duck, and Sonatype Lifecycle.
Explore serviceDependency and license gates on pull requests and builds in GitHub Actions, Azure DevOps, GitLab CI, Jenkins and Bitbucket, with SBOMs produced as build artifacts.
Explore serviceTeam champions who explain reachable CVEs to their peers and know when a copyleft license needs a legal review.
Explore serviceNamed engineer, priority SLAs, and release-time coverage for Checkmarx SCA.
Explore serviceLong-term run support including EPA tuning, license-policy maintenance, and SBOM-generation operations.
Explore serviceEPA tuning and license-policy design workshops for AppSec architects and security engineers, and pull-request onboarding for developers.
Explore serviceMerito supply-chain engineers who keep EPA, license policy and SBOM output in shape while the program runs.
Explore serviceCheckmarx SCA licensing
Checkmarx SCA pricing arrives with EPA configuration, license-policy design, suppression workflow, and PR-time CI/CD integration that drop a 30,000-finding flat list into a triage queue AppSec can actually work.
Merito point of view
SCA programs have run clean reports against vendor defaults, built up 30,000 open CVE findings across the portfolio, and shipped zero remediations because engineers correctly read the backlog as noise. The fix is reachability. Checkmarx EPA cross-checks SCA findings against SAST flow paths and demotes CVEs in code paths that are not actually called from production. On real portfolios that turns a flat 30,000-finding list into a several-thousand-finding queue AppSec can actually work.
Checkmarx SCA is worth choosing when reachability matters, when license discipline needs per-application granularity, and when consolidation onto Checkmarx One pays back the integration cost. If a mature Snyk SCA pipeline with reachability is already running, a switch to Checkmarx becomes a year-long project whose gain rarely covers the disruption, and the recommendation is to keep what works.
Supply-chain governance depends on pairing SCA with Malicious Package Protection and Repository Health. SCA finds risk in dependencies already in the build. Malicious Package Protection blocks supply-chain attacks at registry-fetch time. Repository Health scores an open-source project's hygiene before anyone adds it. Programs running SCA without sourcing-time controls are doing periodic detection rather than active prevention.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share your dependency-tree shape, current SCA tool if any, and AppSec program posture. A Merito Checkmarx specialist follows up within one business day.
Reachability first
Exploitable Path Analysis demotes CVEs in unreachable code. The 30,000-finding backlog drops to a working queue.
License policy
Different rules for internal tooling and customer-facing SaaS. Blanket copyleft bans block legitimate internal use.
Next step
A Merito Checkmarx SCA engagement starts with EPA configuration and license-policy design. Default-rule scans against vendor settings generate noise that erodes developer trust quickly.